IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-04-01 17:28

MODIFIED

2026-04-01 17:28

EPSS (Prob. Exploit)

0.40%

Top 65.3%

DATA SOURCES:

NVD 🔗 2026-04-01 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-05 OSV 🔗 2026-11-01

> DESCRIPTION

An unauthenticated remote code execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deserialize untrusted user input and execute the resulting object.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-2gmp-34j9-fqjm MODERATE

Replicator deserializes untrusted user input

AFFECTED PACKAGES:

NPM / replicator

<= 1.0.5

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Replicator 1.0.5 is vulnerable to Remote Code Execution through Insecure Deserialization

AFFECTED PACKAGES:

Unknown / Unknown

2 versions affected

ALIASES:

GHSA-2gmp-34j9-fqjm

> HISTORIQUE DES MODIFICATIONS

Première apparition

01/04/2026 17:28

Source: NVD

Total des modifications: 0 Dernière mise à jour: 7 months ago

> REFERENCES

https://github.com/inikulin/replicator

https://github.com/inikulin/replicator/pull/19

https://morielharush.github.io/2026/03/31/cve-2026-2265-replicator-deserializati...